Roles and permissions

Claos has two layers of access. The workspace role controls what someone can do across the whole workspace. The project membership can override that for a single project, letting you grant or limit access more narrowly. Knowing the difference makes role decisions a lot easier.

Workspace roles

Four roles, set when you invite someone. From most to least access:

Owner. One per workspace, assigned at creation. Full control of everything — settings, members, billing, the workspace itself. The Owner role isn't grantable via invite; the person who created the workspace holds it.
Admin. Manages members, workspace settings, billing, and the workspace-wide integrations and messaging channels in Settings. Most of what an Owner can do, with the exception of workspace-level destruction.
Member. Reads and edits across the workspace. Creates projects, pages, agents, and teams. Runs agents. Can't manage other members or billing.
Viewer. Read-only across the workspace. Can't create or edit anything. Useful for stakeholders or clients who need to see the work but shouldn't change it.

Project-level overrides

When you add someone to a project — Project Settings → Members → Add — you pick a project-scoped role:

Member. Reads and edits this project.
Viewer. Read-only on this project.

These override the workspace role for that project only. Two patterns to keep in mind:

A workspace Viewer added as a project Member can edit that one project but stays read-only everywhere else. Useful for a contractor who works on one thing.
A workspace Member who isn't on a project's member list can still see it if the project is workspace-visible. Project-level access becomes restrictive only when you treat a project as private to its members.

Changing a role after invite

Workspace roles are set at invite time. To change someone's role later, remove the member and re-invite with the new role. Their work stays in the workspace — every resource (project, page, task, comment) is owned by the resource itself, not by the person who created it.

Project-level memberships, by contrast, are editable any time from the project's Members tab.

Common patterns

A teammate who manages day-to-day but not billing. → Admin.
A client who should see one project. → Guest invite to that project (see Inviting people to your workspace).
A contractor who edits one project but nothing else. → Workspace Viewer + project Member on the relevant project.
A stakeholder who reviews progress without changing anything. → Workspace Viewer.

Tips and gotchas

Pick before you invite. Changing a workspace role means remove-and-re-invite, so picking the right role up front saves a round trip.
Member ≠ project Member. The same word is used at both levels. When you read or write about a person's access, name the scope: "workspace Member" or "project Member."
Owner is one slot. It's assigned at workspace creation and isn't grantable through invites or role changes. If you need a different person to act as Owner, talk to support.